23andMe Settles Class Action Lawsuit Over Data Breach, Agrees to Pay $30 Million to Users

https://icaro.icaromediagroup.com/system/images/photos/16349018/original/open-uri20240914-18-5mjsa4?1726358072
ICARO Media Group
News
14/09/2024 23h44

The lawsuit revolves around a major data breach that resulted in the compromise of sensitive information belonging to approximately 6.9 million users. As part of the preliminary settlement, 23andMe has agreed to pay a sum of $30 million to affected customers. However, the terms of the settlement are still subject to approval by a judge.

The settlement terms, outlined in a filing, not only include financial compensation but also require 23andMe to take further measures to enhance cybersecurity. The company will conduct annual computer scans and cybersecurity audits for the next three years. Additionally, a dedicated website will be created to notify users eligible for compensation and facilitate the distribution of settlement funds.

One key aspect of the settlement is the provision for affected users to delete all their information from the service. They will be provided with a link to easily remove their data from 23andMe's system. Furthermore, users will also have the option to enroll in a three-year Privacy & Medical Shield + Genetic Monitoring program, which will be offered free of charge.

The breach, which occurred in 2023, led to the unauthorized access and theft of DNA Relatives profile information of around 5.5 million customers, as well as the Family Tree profile information of 1.4 million DNA Relative participants. According to legal filings, the breach was enabled by a technique known as credential stuffing, where hackers used previously compromised login credentials to gain access to customer accounts.

The data breach resulted in multiple class action lawsuits being filed against 23andMe, including one that alleged the company failed to inform plaintiffs who were specifically targeted due to their Chinese and Ashkenazi Jewish heritage.

In response to the consolidated lawsuit, 23andMe has maintained that it denies the claims and allegations put forth in the complaint. The company asserts that it took appropriate measures to safeguard the personal information of its consumers and users.

According to financial reports, 23andMe reported a revenue of $220 million for the fiscal year of 2024, a decline of 27% compared to the previous year's $299 million. The company's financial condition is described as "extremely uncertain." However, a significant portion of the $30 million settlement is expected to be covered by cyber insurance, with $25 million allocated for this purpose.

While the settlement provides some relief for affected users, the final approval from the judge is still pending. It serves as a reminder of the importance of robust cybersecurity measures to protect personal information in the digital age.

Note: The information provided is based on the text provided by the user and has been paraphrased to fit into a news article.

The views expressed in this article do not reflect the opinion of ICARO, or any of its affiliates.

Related